VARA - CMA - FSRA - DFSA
The United Arab Emirates as a jurisdiction for crypto businesses
With MiCA’s transitional period now over, European crypto firms face a more restrictive licensing environment. Against that backdrop, the UAE’s appeal rests not only on tax, but on the breadth, flexibility and continuing development of its regulatory framework.
The United Arab Emirates as a jurisdiction for crypto businesses
With MiCA’s transitional period now over, European crypto firms face a more restrictive licensing environment. Against that backdrop, the UAE’s appeal rests not only on tax, but on the breadth, flexibility and continuing development of its regulatory framework.
The end of the MiCA transition
1 July 2026 marked a date for which Europe’s cryptoasset market had been preparing for three years. The transitional period under Article 143(3) of Regulation (EU) 2023/1114, better known as MiCA, came to an end.
Firms that had previously operated under national virtual asset service provider registration regimes could no longer continue serving EU clients without authorisation as a cryptoasset service provider, or CASP.
The scale of that selection process can be seen in the register maintained by the European Securities and Markets Authority. As at 31 July 2026, approximately 320 authorised service providers were listed across the entire European Economic Area.
It is against this background that the growing interest of crypto businesses in the UAE should be considered. The attraction is not simply a matter of lower tax. It is also a consequence of the way the UAE has chosen to structure its regulatory environment.
Four regulatory routes
The defining feature of the UAE model is that it does not rely on a single regulatory regime. Instead, firms can operate within one of four parallel frameworks.
The first is Dubai’s Virtual Assets Regulatory Authority, or VARA. Established under Dubai Law No. 4 of 2022, VARA was the world’s first independent regulator dedicated entirely to the virtual asset sector.
VARA regulates eight distinct activities, covering advisory services, broker-dealer services, custody, exchange services, lending and borrowing, management and investment services, transfer and settlement, and virtual asset issuance.
The second framework is administered by the Financial Services Regulatory Authority, or FSRA, within Abu Dhabi Global Market free zone.
The third is the Dubai Financial Services Authority, or DFSA, which regulates financial services within the Dubai International Financial Centre free zone.
The fourth operates at the federal level. The Central Bank of the UAE has a defined crypto-related remit covering payment tokens, including fiat-referenced stablecoins. Separately, it is responsible for the Digital Dirham, the UAE’s central bank digital currency. Other onshore virtual asset activities outside the VARA, ADGM and DIFC perimeters fall within the remit of the Capital Market Authority. Until 1 January 2026, this authority was known as the Securities and Commodities Authority.
A firm can therefore select the regulatory route that most closely matches its business model, products and intended client base.
That is materially different from the European structure, where the regulatory regime is largely uniform and the main choice available to an applicant is the Member State in which to apply.
How the UAE compares with Europe
The comparison with Europe is instructive.
According to ESMA’s Interim MiCA Register, which is updated weekly, 321 firms had obtained CASP authorisation across the European Economic Area by 31 July 2026. That figure covers the 27 EU Member States together with Iceland, Liechtenstein and Norway.
Of those firms, 68 were authorised in Germany, 35 in France and 28 in the Netherlands.
VARA’s public register, by comparison, contains more than 50 licensed firms. More than 20 additional businesses conduct virtual asset and fiat-referenced token activities within Abu Dhabi Global Market.
Looking at the position on a jurisdiction-by-jurisdiction basis helps put those figures into context. Thirty EEA countries operating under a common passport produced 321 authorised providers, equivalent to an average of approximately 11 firms per country.
Dubai and Abu Dhabi together account for more than 70 licensed firms. That is more than the total authorised in any individual EU Member State, including Germany, which leads the European market with 66.
In theory, the ability to passport a MiCA authorisation throughout the EEA should give the European regime a significant advantage. In practice, the difference between the two markets has been less pronounced than might have been expected.
The scale of activity in Dubai is also relevant. According to the Government of Dubai, by October 2025 the value of transactions carried out by VARA-regulated firms since the beginning of that year was approaching AED 2.5 trillion.
Abu Dhabi’s evolving framework
Dubai is not the only UAE jurisdiction developing its virtual asset regime.
In June 2025, the FSRA introduced a series of changes to the digital asset framework in Abu Dhabi Global Market. These included a more streamlined process for accepting virtual assets for use, revised capital requirements and fees, and new powers allowing the regulator to intervene in relation to particular products. The amendments also formally prohibited privacy tokens.
A separate regime for fiat-referenced tokens was introduced in December 2024. From 1 January 2026, the range of regulated activities that could be conducted using those tokens was expanded.
By December 2025, more than 20 licensed firms were conducting digital asset business in ADGM. These included brokers, custodians, exchanges, asset managers and issuers of fiat-referenced tokens.
The contrast with Europe is particularly visible in this area.
As at 31 July 2026, ESMA’s register included 21 issuers of e-money tokens but no authorised issuer of an asset-referenced token. This means that, throughout the period in which MiCA has applied, no asset-referenced token issuer had successfully completed the authorisation process.
That does not necessarily mean that there is no European demand for such products. It does, however, suggest that the regulatory threshold has proved difficult to meet. In Abu Dhabi, by contrast, the issuance of fully backed fiat-referenced tokens already operates as a recognised regulated activity.
DIFC and firm-level responsibility
The DFSA has taken a different approach within the Dubai International Financial Centre.
From 1 January 2026, updated client asset protection requirements came into force, including requirements applicable to crypto tokens held for clients.
Further changes followed on 12 January 2026. The DFSA discontinued its centralised list of Recognised Crypto Tokens and placed responsibility for token suitability directly on regulated firms.
A firm must now determine, on reasonable grounds and through a documented assessment, whether a particular crypto token is suitable for the activity it intends to conduct. The regulator continues to supervise the quality of those assessments and to develop the wider framework.
This is a useful example of the underlying philosophy of the UAE model. The project selects the regime that fits its activities; the activities do not necessarily have to be redesigned to fit a single regime.
There is measurable demand for this approach. The DFSA’s Tokenisation Regulatory Sandbox, launched in March 2025, received 96 expressions of interest from firms based in the UAE, the UK, the EU, Canada, Singapore and Hong Kong.
The fact that some of those applications came from the EU is significant. Tokenised securities generally fall outside MiCA where they qualify as financial instruments and are therefore regulated under the existing capital markets framework rather than through a dedicated tokenisation regime.
The tax position
Tax inevitably forms part of the analysis.
Under Federal Decree-Law No. 47 of 2022, the standard UAE corporate tax rate is 9% on taxable income exceeding AED 375,000.
For a European reader, that is the same headline rate offered by the EU’s lowest-tax jurisdiction. Hungary applies a corporate income tax rate of 9%, the lowest in the region, while the simple average nominal rate across the 27 EU Member States is approximately 21.4%, based on Tax Foundation data for 2026.
Even in Hungary, the effective burden may be higher than the headline rate. A local business tax, known as HIPA, can be charged at up to 2% and is calculated by reference to an adjusted turnover base rather than corporate profit.
UAE free-zone companies that meet the conditions for Qualifying Free Zone Person status may apply a 0% corporate tax rate to Qualifying Income. This treatment is subject to requirements relating to adequate economic substance, transfer pricing and other compliance conditions.
The VAT position is also favourable. Transactions involving virtual assets were exempted from VAT under Cabinet Decision No. 100 of 2024, with the exemption applying retrospectively from 1 January 2018.
The UAE does not impose a general personal income tax. In the EU, by comparison, income and gains arising from cryptoasset transactions are taxed at Member State level under the domestic rules of each country.
The conclusion is difficult to avoid: even the EU’s most competitive headline corporate tax regime does not offer the same overall tax position as the UAE.
AML credibility
One of the principal objections raised against the UAE several years ago has also become materially less persuasive.
On 23 February 2024, the Financial Action Task Force removed the UAE from its list of jurisdictions under increased monitoring. The country had been included on that list since 4 March 2022.
The UAE was subsequently removed from the EU’s list of high-risk third countries on 5 August 2025, following Commission Delegated Regulation (EU) 2025/1184 of 10 June 2025.
For EU counterparties, that change removed the automatic requirement to apply enhanced due diligence solely because a customer or transaction was connected with the UAE.
Regulatory development did not stop there.
Federal Decree-Law No. 10 of 2025 entered into force on 14 October 2025, replacing the UAE’s 2018 anti-money laundering legislation. Its implementing regulation was adopted under Cabinet Decision No. 134 of 2025.
The new framework expressly addresses activities involving virtual assets and strengthens AML/CFT compliance requirements.
Independent market research points in the same direction. According to Chainalysis, the UAE economy received more than US$56 billion in cryptoasset value during the 2024–2025 reporting period, representing growth of approximately 33% compared with the previous period.
The direction of travel
The direction of travel is clear.
The UAE is continuing to build out the parts of the regulatory framework that were previously missing, without dismantling what is already in place.
Licensing rules were followed by formal requirements for the issuance of asset-backed tokens. The introduction of stablecoin regulation was followed by an expansion of the activities that may be conducted using those tokens.
The regulators have adopted a model of continuing refinement and increasing alignment, rather than relying on occasional large-scale reforms. This provides firms with a stronger basis on which to anticipate how the market is likely to develop.
That does not mean that the UAE is a light-touch jurisdiction. Applicants must still demonstrate appropriate governance, capital, local substance, technology, custody arrangements and financial crime controls. The relevant requirements will depend on the regulator and the activities being proposed.
The more useful question is therefore not whether the UAE is less regulated than Europe. It is whether its regulatory architecture gives firms more viable ways to bring a compliant business model to market.
For businesses focused on Asia, the Middle East and Africa, and for projects involving the tokenisation of real-world assets, the UAE offers a combination that is difficult to replicate elsewhere: specialist regulators, a predictable tax environment, an AML framework recognised by international standard setters and an established ecosystem of licensed market participants.
In practice, that combination may prove more important than the promise of a regulatory passport alone.
Sources:
1. Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets (MiCA), art. 143(3). URL: eur-lex.europa.eu/eli/reg/2023/1114/oj
2. List of MiCA grandfathering periods (Article 143(3)) // ESMA. URL: www.esma.europa.eu/sites/default/files/2024-12/List_of_MiCA_grandfathering_periods_art._143_3.pdf
3. Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai // VARA Rulebooks. URL: rulebooks.vara.ae/rulebook/law-no-4-2022-regulating-virtual-assets-emirate-dubai
4. VARA issues updated activity rulebooks, 19.05.2025 // VARA. URL: www.vara.ae/en/news/vara-issues-updated-activity-rulebooks-to-strengthen-market-integrity-and-risk-oversight/
5. Maktoum bin Mohammed approves the Dubai Financial Sector Strategy, 12.10.2025 // Dubai Media Office. URL: mediaoffice.ae/en/news/2025/october/12-10/maktoum-bin-mohammed-approves-the-financial-sector-strategy
6. ADGM FSRA: amendments to the Digital Asset Regulatory Framework, 10.06.2025; framework for activities involving Fiat-Referenced Tokens // ADGM. URL: www.adgm.com/media/announcements/adgm-fsra-implements-amendments-to-its-digital-asset-regulatory-framework
7. DFSA implements major updates to Crypto Token Regulatory Framework, 12.01.2026 // DFSA. URL:; www.dfsa.ae/crypto
8. Payment Token Services Regulation (Circular No. 2/2024) // CBUAE Rulebook. URL: rulebook.centralbank.ae/en/rulebook/payment-token-services-regulation
9. Federal Decree-Law No. 47 of 2022 on the Taxation of Corporations and Businesses // Ministry of Finance UAE. URL: mof.gov.ae/wp-content/uploads/2022/12/Federal-Decree-Law-No.-47-of-2022-EN.pdf
10. Cabinet Decision No. 100 of 2024 amending the VAT Executive Regulation (VATP040) // Federal Tax Authority.
11. Jurisdictions under Increased Monitoring, 23.02.2024 // FATF. URL: www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/Increased-monitoring-february-2024.html
12. Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering and CFT (в силе с 14.10.2025) и исполнительный регламент Cabinet Resolution No. 134 of 2025 // UAE Legislation. URL: uaelegislation.gov.ae/en/legislations/3314
13. Crypto Adoption in MENA, 2025 // Chainalysis. URL: chainalysis.com/blog/middle-east-north-africa-crypto-adoption-2025
The end of the MiCA transition
1 July 2026 marked a date for which Europe’s cryptoasset market had been preparing for three years. The transitional period under Article 143(3) of Regulation (EU) 2023/1114, better known as MiCA, came to an end.
Firms that had previously operated under national virtual asset service provider registration regimes could no longer continue serving EU clients without authorisation as a cryptoasset service provider, or CASP.
The scale of that selection process can be seen in the register maintained by the European Securities and Markets Authority. As at 31 July 2026, approximately 320 authorised service providers were listed across the entire European Economic Area.
It is against this background that the growing interest of crypto businesses in the UAE should be considered. The attraction is not simply a matter of lower tax. It is also a consequence of the way the UAE has chosen to structure its regulatory environment.
Four regulatory routes
The defining feature of the UAE model is that it does not rely on a single regulatory regime. Instead, firms can operate within one of four parallel frameworks.
The first is Dubai’s Virtual Assets Regulatory Authority, or VARA. Established under Dubai Law No. 4 of 2022, VARA was the world’s first independent regulator dedicated entirely to the virtual asset sector.
VARA regulates eight distinct activities, covering advisory services, broker-dealer services, custody, exchange services, lending and borrowing, management and investment services, transfer and settlement, and virtual asset issuance.
The second framework is administered by the Financial Services Regulatory Authority, or FSRA, within Abu Dhabi Global Market free zone.
The third is the Dubai Financial Services Authority, or DFSA, which regulates financial services within the Dubai International Financial Centre free zone.
The fourth operates at the federal level. The Central Bank of the UAE has a defined crypto-related remit covering payment tokens, including fiat-referenced stablecoins. Separately, it is responsible for the Digital Dirham, the UAE’s central bank digital currency. Other onshore virtual asset activities outside the VARA, ADGM and DIFC perimeters fall within the remit of the Capital Market Authority. Until 1 January 2026, this authority was known as the Securities and Commodities Authority.
A firm can therefore select the regulatory route that most closely matches its business model, products and intended client base.
That is materially different from the European structure, where the regulatory regime is largely uniform and the main choice available to an applicant is the Member State in which to apply.
How the UAE compares with Europe
The comparison with Europe is instructive.
According to ESMA’s Interim MiCA Register, which is updated weekly, 321 firms had obtained CASP authorisation across the European Economic Area by 31 July 2026. That figure covers the 27 EU Member States together with Iceland, Liechtenstein and Norway.
Of those firms, 68 were authorised in Germany, 35 in France and 28 in the Netherlands.
VARA’s public register, by comparison, contains more than 50 licensed firms. More than 20 additional businesses conduct virtual asset and fiat-referenced token activities within Abu Dhabi Global Market.
Looking at the position on a jurisdiction-by-jurisdiction basis helps put those figures into context. Thirty EEA countries operating under a common passport produced 321 authorised providers, equivalent to an average of approximately 11 firms per country.
Dubai and Abu Dhabi together account for more than 70 licensed firms. That is more than the total authorised in any individual EU Member State, including Germany, which leads the European market with 66.
In theory, the ability to passport a MiCA authorisation throughout the EEA should give the European regime a significant advantage. In practice, the difference between the two markets has been less pronounced than might have been expected.
The scale of activity in Dubai is also relevant. According to the Government of Dubai, by October 2025 the value of transactions carried out by VARA-regulated firms since the beginning of that year was approaching AED 2.5 trillion.
Abu Dhabi’s evolving framework
Dubai is not the only UAE jurisdiction developing its virtual asset regime.
In June 2025, the FSRA introduced a series of changes to the digital asset framework in Abu Dhabi Global Market. These included a more streamlined process for accepting virtual assets for use, revised capital requirements and fees, and new powers allowing the regulator to intervene in relation to particular products. The amendments also formally prohibited privacy tokens.
A separate regime for fiat-referenced tokens was introduced in December 2024. From 1 January 2026, the range of regulated activities that could be conducted using those tokens was expanded.
By December 2025, more than 20 licensed firms were conducting digital asset business in ADGM. These included brokers, custodians, exchanges, asset managers and issuers of fiat-referenced tokens.
The contrast with Europe is particularly visible in this area.
As at 31 July 2026, ESMA’s register included 21 issuers of e-money tokens but no authorised issuer of an asset-referenced token. This means that, throughout the period in which MiCA has applied, no asset-referenced token issuer had successfully completed the authorisation process.
That does not necessarily mean that there is no European demand for such products. It does, however, suggest that the regulatory threshold has proved difficult to meet. In Abu Dhabi, by contrast, the issuance of fully backed fiat-referenced tokens already operates as a recognised regulated activity.
DIFC and firm-level responsibility
The DFSA has taken a different approach within the Dubai International Financial Centre.
From 1 January 2026, updated client asset protection requirements came into force, including requirements applicable to crypto tokens held for clients.
Further changes followed on 12 January 2026. The DFSA discontinued its centralised list of Recognised Crypto Tokens and placed responsibility for token suitability directly on regulated firms.
A firm must now determine, on reasonable grounds and through a documented assessment, whether a particular crypto token is suitable for the activity it intends to conduct. The regulator continues to supervise the quality of those assessments and to develop the wider framework.
This is a useful example of the underlying philosophy of the UAE model. The project selects the regime that fits its activities; the activities do not necessarily have to be redesigned to fit a single regime.
There is measurable demand for this approach. The DFSA’s Tokenisation Regulatory Sandbox, launched in March 2025, received 96 expressions of interest from firms based in the UAE, the UK, the EU, Canada, Singapore and Hong Kong.
The fact that some of those applications came from the EU is significant. Tokenised securities generally fall outside MiCA where they qualify as financial instruments and are therefore regulated under the existing capital markets framework rather than through a dedicated tokenisation regime.
The tax position
Tax inevitably forms part of the analysis.
Under Federal Decree-Law No. 47 of 2022, the standard UAE corporate tax rate is 9% on taxable income exceeding AED 375,000.
For a European reader, that is the same headline rate offered by the EU’s lowest-tax jurisdiction. Hungary applies a corporate income tax rate of 9%, the lowest in the region, while the simple average nominal rate across the 27 EU Member States is approximately 21.4%, based on Tax Foundation data for 2026.
Even in Hungary, the effective burden may be higher than the headline rate. A local business tax, known as HIPA, can be charged at up to 2% and is calculated by reference to an adjusted turnover base rather than corporate profit.
UAE free-zone companies that meet the conditions for Qualifying Free Zone Person status may apply a 0% corporate tax rate to Qualifying Income. This treatment is subject to requirements relating to adequate economic substance, transfer pricing and other compliance conditions.
The VAT position is also favourable. Transactions involving virtual assets were exempted from VAT under Cabinet Decision No. 100 of 2024, with the exemption applying retrospectively from 1 January 2018.
The UAE does not impose a general personal income tax. In the EU, by comparison, income and gains arising from cryptoasset transactions are taxed at Member State level under the domestic rules of each country.
The conclusion is difficult to avoid: even the EU’s most competitive headline corporate tax regime does not offer the same overall tax position as the UAE.
AML credibility
One of the principal objections raised against the UAE several years ago has also become materially less persuasive.
On 23 February 2024, the Financial Action Task Force removed the UAE from its list of jurisdictions under increased monitoring. The country had been included on that list since 4 March 2022.
The UAE was subsequently removed from the EU’s list of high-risk third countries on 5 August 2025, following Commission Delegated Regulation (EU) 2025/1184 of 10 June 2025.
For EU counterparties, that change removed the automatic requirement to apply enhanced due diligence solely because a customer or transaction was connected with the UAE.
Regulatory development did not stop there.
Federal Decree-Law No. 10 of 2025 entered into force on 14 October 2025, replacing the UAE’s 2018 anti-money laundering legislation. Its implementing regulation was adopted under Cabinet Decision No. 134 of 2025.
The new framework expressly addresses activities involving virtual assets and strengthens AML/CFT compliance requirements.
Independent market research points in the same direction. According to Chainalysis, the UAE economy received more than US$56 billion in cryptoasset value during the 2024–2025 reporting period, representing growth of approximately 33% compared with the previous period.
The direction of travel
The direction of travel is clear.
The UAE is continuing to build out the parts of the regulatory framework that were previously missing, without dismantling what is already in place.
Licensing rules were followed by formal requirements for the issuance of asset-backed tokens. The introduction of stablecoin regulation was followed by an expansion of the activities that may be conducted using those tokens.
The regulators have adopted a model of continuing refinement and increasing alignment, rather than relying on occasional large-scale reforms. This provides firms with a stronger basis on which to anticipate how the market is likely to develop.
That does not mean that the UAE is a light-touch jurisdiction. Applicants must still demonstrate appropriate governance, capital, local substance, technology, custody arrangements and financial crime controls. The relevant requirements will depend on the regulator and the activities being proposed.
The more useful question is therefore not whether the UAE is less regulated than Europe. It is whether its regulatory architecture gives firms more viable ways to bring a compliant business model to market.
For businesses focused on Asia, the Middle East and Africa, and for projects involving the tokenisation of real-world assets, the UAE offers a combination that is difficult to replicate elsewhere: specialist regulators, a predictable tax environment, an AML framework recognised by international standard setters and an established ecosystem of licensed market participants.
In practice, that combination may prove more important than the promise of a regulatory passport alone.
Sources:
1. Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets (MiCA), art. 143(3). URL: eur-lex.europa.eu/eli/reg/2023/1114/oj
2. List of MiCA grandfathering periods (Article 143(3)) // ESMA. URL: www.esma.europa.eu/sites/default/files/2024-12/List_of_MiCA_grandfathering_periods_art._143_3.pdf
3. Law No. (4) of 2022 Regulating Virtual Assets in the Emirate of Dubai // VARA Rulebooks. URL: rulebooks.vara.ae/rulebook/law-no-4-2022-regulating-virtual-assets-emirate-dubai
4. VARA issues updated activity rulebooks, 19.05.2025 // VARA. URL: www.vara.ae/en/news/vara-issues-updated-activity-rulebooks-to-strengthen-market-integrity-and-risk-oversight/
5. Maktoum bin Mohammed approves the Dubai Financial Sector Strategy, 12.10.2025 // Dubai Media Office. URL: mediaoffice.ae/en/news/2025/october/12-10/maktoum-bin-mohammed-approves-the-financial-sector-strategy
6. ADGM FSRA: amendments to the Digital Asset Regulatory Framework, 10.06.2025; framework for activities involving Fiat-Referenced Tokens // ADGM. URL: www.adgm.com/media/announcements/adgm-fsra-implements-amendments-to-its-digital-asset-regulatory-framework
7. DFSA implements major updates to Crypto Token Regulatory Framework, 12.01.2026 // DFSA. URL:; www.dfsa.ae/crypto
8. Payment Token Services Regulation (Circular No. 2/2024) // CBUAE Rulebook. URL: rulebook.centralbank.ae/en/rulebook/payment-token-services-regulation
9. Federal Decree-Law No. 47 of 2022 on the Taxation of Corporations and Businesses // Ministry of Finance UAE. URL: mof.gov.ae/wp-content/uploads/2022/12/Federal-Decree-Law-No.-47-of-2022-EN.pdf
10. Cabinet Decision No. 100 of 2024 amending the VAT Executive Regulation (VATP040) // Federal Tax Authority.
11. Jurisdictions under Increased Monitoring, 23.02.2024 // FATF. URL: www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/Increased-monitoring-february-2024.html
12. Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering and CFT (в силе с 14.10.2025) и исполнительный регламент Cabinet Resolution No. 134 of 2025 // UAE Legislation. URL: uaelegislation.gov.ae/en/legislations/3314
13. Crypto Adoption in MENA, 2025 // Chainalysis. URL: chainalysis.com/blog/middle-east-north-africa-crypto-adoption-2025